A common task performed by network devices is to forward packet traffic on a network. To do this, network devices typically maintain a forwarding database that might include a table of forwarding addresses and corresponding ports. An example of network packet forwarding includes the use media access control, or MAC, addresses to route and/or forward packet traffic on a network. Forwarding packet traffic in hardware (i.e., directly accessing forwarding entries in hardware for forwarding purposes) is typically much faster than forwarding packet traffic in software. Because of this, it is desirable to maintain a forwarding database in hardware.
It may also be desirable, for a network administrator to monitor a network (e.g., for the purpose of maintaining the network). One component of monitoring a network might include reviewing entries in the forwarding database. To accomplish this, the network administrator can set up a forwarding database scan to read forwarding database entries that are stored in memory and send those entries back to a management module for display, allowing the network administrator to analyze the entries. One challenge with scanning a hardware-based forwarding database is that the address table is often organized as a hash table. This means that it is difficult to know where in memory a particular address, is stored. Another limitation is that there is often a maximum burst size of data that can be sent from a network device to a management module. For example, a network device may have an address space that is 512K in size, but the maximum burst size for sending data to the management module might only be 4K. Based on the constraints of the burst size, it is common to limit a forwarding database scan size to the maximum burst size. In other words, if the maximum burst size is 4K, then a scan might only read 4K addresses before terminating and returning the results to the management module.
Knowing that many forwarding database entries do not change between scans, it is not useful to return duplicate or previously read entries to the management module. However, by capping the scan size (e.g., to 4K), the resulting burst sent to the management module may be much smaller than the 4K burst size, given that many of the entries are either duplicates, or have been read previously.